Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clang runs in the browser and compiles C++ to WebAssembly

tbfleming.github.io

Post reply on HN
Print view View original

191–200 of 318 posts

Re: Clang runs in the browser and compiles C++ to WebAssembly

#191

Post by TomMarius »

jeremyjh wrote: post #182
blub wrote: post #139

Earlier quoted context omitted.

> a sandbox strong enough to run completely untrusted code No browser has provided that either. In fact, browsers are by definition a security anti-feature because they are always connected to the network and the customer/user data lives on the network. Even if they manage to solve the problem of computers getting hacked when visiting websites they are very unlikely to solve the problems of tracking and private data…

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code e…

Yes. The web itself is harmless; it's the stuff you download and run that harms you.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#192

Post by dpwm »

jeremyjh wrote: post #182
blub wrote: post #139

Earlier quoted context omitted.

> a sandbox strong enough to run completely untrusted code No browser has provided that either. In fact, browsers are by definition a security anti-feature because they are always connected to the network and the customer/user data lives on the network. Even if they manage to solve the problem of computers getting hacked when visiting websites they are very unlikely to solve the problems of tracking and private data…

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code e…

Anecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0].

[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Re: Clang runs in the browser and compiles C++ to WebAssembly

#193

Post by anon1385 »

cm2187 wrote: post #159
int_19h wrote: post #142

Earlier quoted context omitted.

JVM had to be installed, and it was far from seamless the way OP describes it. The advantage of wasm is that all the people running Chrome today already have it.

Plus the java installer would sneak in some junkware/toolbars in the process

Yes, thankfully no web browser vendor would ever do such a thing.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#195

Post by geocar »

proaralyst wrote: post #135
cm2187 wrote: post #102

Earlier quoted context omitted.

When you launch private mode (save for browser fingerprinting and other super cookies), you are a new user to the website. When you close it, anything the website attempted to store on your machine is gone. Of course it can track you during that session but not before or after.

Unfortunately techniques like browser fingerprinting[0] still work in private browsing and can be used to link your private browsing to your normal browsing. [0]: https://en.wikipedia.org/wiki/Device_fingerprint

Can, but usually aren’t. Advertisers aren’t interested in advertising to you unless it’ll “work” (in terms of sales, clicks, or whatever the KPI is). If I think you want to not see my ad, I don’t want to buy your eyeballs.

My own experiments with GL and the timing-based methods is that they just don’t work well (compared to say, cookies) when delivered via an advertisement. Plugins and fonts work very poorly as well, lately.

I don’t think anyone is using these methods to target advertising, and state-level actors don’t have to (they just bug your ISP).

Who are you trying to protect against?

Re: Clang runs in the browser and compiles C++ to WebAssembly

#197

Post by clouddrover »

solarkraft wrote: post #84
clouddrover wrote: post #78

Earlier quoted context omitted.

> WebAssembly doesn't do UIs, that component is still built in HTML Your UI could be HTML, but equally it could be a WebGL-based UI. Some UI libraries already use OpenGL as a backend so adding support for a WebGL backend shouldn't be too hard.

Can you point me to them? Thinking about using HTML to build an app with good UX lets magic smoke leave my head.

Qt can work in the browser. Here's a Qt blog post talking about their Emscripten support: https://blog.qt.io/blog/2015/09/25/qt-for-native-client-and-...

You can also stream Qt applications via WebGL (runs server side, UI streamed to the browser): https://blog.qt.io/blog/2017/07/07/qt-webgl-streaming-merged...

Some asm.js Qt examples: http://vps2.etotheipiplusone.com:30176/redmine/projects/emsc...

Some WebAssembly Qt examples: https://github.com/msorvig/qt-webassembly-examples

Re: Clang runs in the browser and compiles C++ to WebAssembly

#198

Post by Goladus »

lmm wrote: post #178
modeless wrote: post #83

Earlier quoted context omitted.

The answer is that browsers provide something that users desperately need and no operating system has ever provided: a sandbox strong enough to run completely untrusted code. The success of browsers is an indictment of the entire field of operating systems research. They have either failed to recognize the need or simply failed to deliver that kind of security. For one example take WebGL. For decades OpenGL had been…

> The answer is that browsers provide something that users desperately need and no operating system has ever provided: a sandbox strong enough to run completely untrusted code. The success of browsers is an indictment of the entire field of operating systems research. They have either failed to recognize the need or simply failed to deliver that kind of security. The JVM more-or-less managed it. Modern hypervisors do…

The JVM took too long to achieve that ideal in a way that actually worked for end-user applications. Early java-based client applications had a horrible user experience. Version conflicts were very annoying, especially on windows where you didn't have a command-line culture comfortable with simply switching between versions by modifying PATH and JAVA_HOME. And even when you didn't have version conflicts, Java applications had slow, idiosyncratic GUIs that often did not support basic and common features like ability to copy/paste or switch to arrow-key navigation through menus.

And on top of all that, it would still be more memory intensive than an equivalent native win32 application. Developers usually only shipped java-based UIs to Enterprise Software users who had no choice but to use what their bosses told them to use.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#199

Post by clouddrover »

contrarian_ wrote: post #183
clouddrover wrote: post #78

Earlier quoted context omitted.

> WebAssembly doesn't do UIs, that component is still built in HTML Your UI could be HTML, but equally it could be a WebGL-based UI. Some UI libraries already use OpenGL as a backend so adding support for a WebGL backend shouldn't be too hard.

> but equally it could be a WebGL-based UI Then you might as well ship a native binary. Beyond cross-compilation and window system bindings, there aren't many more portability concerns. But then you're rebuilding the browser, so the question is whether you can do it better than Google/Microsoft/Apple by including only the truly necessary bloat for your use-case. Bonus: you get to avoid browser politics.

> Then you might as well ship a native binary.

It isn't an either\or choice. You can do both. WebAssembly gives your application a "zero install" option and native gives you better performance.

Re: Clang runs in the browser and compiles C++ to WebAssembly

#200

Post by AnIdiotOnTheNet »

blub wrote: post #136
shalabhc wrote: post #120

Next we'll get to a webassembly-only VM that will replace the OS. All 'apps' will run on this VM instead of being native, and most will be cross platform. They'll talk to each other via messaging (using Javascript semantics) instead of bytes-over-pipes as they do today. An integrated globally available, namespaced data store API might replace the filesystem. Each app+version will be accessible by a distinct URL. 'My…

Add metrics and advertising obsessed companies into the mix and the only result could be a complete clusterfuck. The major issue with web apps is that the customer (or depending on the company bag of meat that watches the ads) has no control over the app or the data. They will be abused by the company in all sorts of creative ways. And yes, those VMs could be local-only, but why would Google, MS or Mozilla want that?…

> Add metrics and advertising obsessed companies into the mix and the only result could be a complete clusterfuck.

Case in point: The Web.

Post reply on HN